Oppiskele Validating File Uploads | File Handling and Uploads

Validating files uploaded by users is a crucial step in any PHP web application that accepts file input. Without proper validation, you risk exposing your application to a variety of security threats and technical issues. Attackers could upload malicious scripts, oversized files could overwhelm your server, and users might accidentally upload unsupported file types. To protect your application and its users, you should always check that the uploaded file is of an allowed type, within acceptable size limits, and free of upload errors.

upload_validation.php


              1234567891011121314151617181920212223242526272829303132333435363738394041424344
            
<?php
// upload_validation.php

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];
    $maxFileSize = 2 * 1024 * 1024; // 2MB

    if (isset($_FILES['userfile']) && $_FILES['userfile']['error'] === UPLOAD_ERR_OK) {
        $fileTmpPath = $_FILES['userfile']['tmp_name'];
        $fileName = $_FILES['userfile']['name'];
        $fileSize = $_FILES['userfile']['size'];
        $fileType = $_FILES['userfile']['type'];

        // Validate file type
        if (!in_array($fileType, $allowedTypes)) {
            echo "Error: Only JPG, PNG, and GIF files are allowed.";
            exit;
        }

        // Validate file size
        if ($fileSize > $maxFileSize) {
            echo "Error: File size exceeds 2MB limit.";
            exit;
        }

        // Save the uploaded file
        $destination = 'uploads/' . basename($fileName);
        if (move_uploaded_file($fileTmpPath, $destination)) {
            echo "File uploaded successfully!";
        } else {
            echo "Error: Could not move the uploaded file.";
        }
    } else {
        echo "Error: " . $_FILES['userfile']['error'];
    }
}
?>

<!-- Simple HTML form for uploading a file -->
<form method="post" enctype="multipart/form-data">
    Select image to upload (JPG, PNG, GIF, max 2MB):
    <input type="file" name="userfile" required>
    <input type="submit" value="Upload">
</form>

The most common checks to perform during file upload validation include:

Checking the file type: ensure only allowed file types (such as images or documents) are accepted;
Verifying the file size: reject files that are too large to prevent server overload or abuse;
Inspecting for upload errors: confirm that the file was uploaded without errors using the $_FILES array;
Optionally, checking file contents: for sensitive applications, you might inspect the file's actual content rather than trusting the file extension.

Note

When you validate each uploaded file, you improve both the security and reliability of your application.

Oliko kaikki selvää?

Kiitos palautteestasi!

Osio 4. Luku 4

Kysy tekoälyä

Kysy mitä tahansa tai kokeile jotakin ehdotetuista kysymyksistä aloittaaksesi keskustelumme

Pyyhkäise näyttääksesi valikon